{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2016-20054", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-04T13:34:39.170Z", "datePublished": "2026-04-04T19:59:25.383Z", "dateUpdated": "2026-04-06T15:38:39.346Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-04-04T19:59:44.200Z"}, "title": "Nodcms Cross Site Request Forgery via admin endpoints", "descriptions": [{"lang": "en", "value": "Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "nodcms", "product": "nodCMS", "versions": [{"version": "1.0", "status": "affected"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.4.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.4.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.3.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.3.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1.4:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1.3:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1.2:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.2.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.2.2:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1.5:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:3.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:2.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nodcms:nodcms:1.0:*:*:*:*:*:*:*"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/40707", "name": "ExploitDB-40707", "tags": ["exploit"]}], "credits": [{"lang": "en", "value": "Ashiyane Digital Security Team", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T15:38:30.321151Z", "id": "CVE-2016-20054", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:38:39.346Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2016-20054", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:38:30.321151Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:38:34.772Z"}}], "cna": {"title": "Nodcms Cross Site Request Forgery via admin endpoints", "credits": [{"lang": "en", "type": "finder", "value": "Ashiyane Digital Security Team"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nodcms", "product": "nodCMS", "versions": [{"status": "affected", "version": "1.0"}]}], "references": [{"url": "https://www.exploit-db.com/exploits/40707", "name": "ExploitDB-40707", "tags": ["exploit"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodcms:nodcms:3.0:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.4.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.4.0:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.3.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.3.0:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1.4:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1.3:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1.2:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.2.0:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.2.2:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.2.1.5:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:3.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:2.0:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodcms:nodcms:1.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-04-04T19:59:44.200Z"}}}, "cveMetadata": {"cveId": "CVE-2016-20054", "state": "PUBLISHED", "dateUpdated": "2026-04-06T15:38:39.346Z", "dateReserved": "2026-04-04T13:34:39.170Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-04T19:59:25.383Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodcms:nodcms:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "34CECE89-C2C5-43DA-89E9-BAAA59DE72DF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nodcms contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious forms. Attackers can trick authenticated administrators into submitting requests to admin/user_manipulate and admin/settings/generall endpoints to create users or modify application settings without explicit consent."}], "id": "CVE-2016-20054", "lastModified": "2026-04-14T16:15:22.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-04-04T20:16:15.940", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/40707"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "nodCMS", "source": "cna", "vendor": "nodcms"}, "product": "nodcms", "vendor": "nodcms"}], "analysis": {"en": {"generated_at": "2026-04-14T17:50:36.020645+00:00", "value": {"mitigation_remediation": ["Upgrade nodCMS to the latest available release that contains the CSRF fix or apply the vendor\u2019s patch for CVE-2016-20054.", "Add CSRF tokens to all administrative forms and enforce SameSite cookie attributes to reduce the risk of unauthorized requests.", "Restrict access to the admin/user_manipulate and admin/settings/generall endpoints by IP whitelisting or VPN only access.", "Enable detailed logging of administrative actions and regularly review logs for anomalous activity.", "Train administrators to recognize and avoid submitting unknown forms or clicking on suspicious links."], "summary": {"action": "Patch Immediately", "impact": "Cross\u2011Site Request Forgery that lets attackers perform unauthorized administrative actions"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all publicly documented nodCMS releases from version 1.0 through 3.4.1, as enumerated by the CPE identifiers in the advisory. Administrators of any of these installations are at risk if the application lacks CSRF protections on the affected admin endpoints.", "description_and_impact": "NodCMS has a vulnerable cross\u2011site request forgery flaw that allows an attacker to cause authenticated administrators to execute privileged actions via crafted forms. This flaw can lead to creation of new administrative users, alteration of system configuration, and potentially additional compromise of the application. The weakness is classified as CWE\u2011352 and is also related to CWE\u201179.", "risk_and_exploitability": "The CVSS base score is 5.3, representing moderate severity, and the EPSS score is below 1%, indicating a low probability of active exploitation as of the latest data. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires a user with administrative privileges who has logged into the system; an attacker can entice such a user to submit a malicious form or embed a crafted request, thereby causing the target to perform privileged operations without their knowledge. The attack vector is likely through web\u2011based phishing or socially engineered content that leverages the trusted session of the administrator."}}}}, "created": "2026-04-06T20:26:55.983978+00:00", "updated": "2026-04-15T16:30:09.751965+00:00", "vendors": ["nodcms", "nodcms$PRODUCT$nodcms"]}